CVE-2025-36050 – IBM QRadar SIEM versions 7.5 through 7.5.0 Upda... (How to Fix)

Q: What is the severity of CVE-2025-36050?

CVE-2025-36050 has a CVSS score of 6.2 (MEDIUM). IBM QRadar SIEM versions 7.5 through 7.5.0 Update Package 12 store sensitive information in log files that local users can read. This information disclosure vulnerability could expose credentials, configuration details, or other sensitive data. Organizations running affected QRadar versions are at risk.

📋 TL;DR

IBM QRadar SIEM versions 7.5 through 7.5.0 Update Package 12 store sensitive information in log files that local users can read. This information disclosure vulnerability could expose credentials, configuration details, or other sensitive data. Organizations running affected QRadar versions are at risk.

💻 Affected Systems

Products:

IBM QRadar SIEM

Versions: 7.5 through 7.5.0 Update Package 12

Operating Systems: Linux (QRadar appliance OS)

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects local users who have access to read log files on the QRadar system.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local attackers gain access to administrative credentials, configuration secrets, or other sensitive data, potentially leading to full system compromise or lateral movement within the network.

🟠

Likely Case

Local users or attackers with limited access can read sensitive information from log files, potentially obtaining credentials or configuration details that could be used for further attacks.

🟢

If Mitigated

With proper access controls and log file permissions, only authorized administrators can access log files, limiting exposure to sensitive information.

🌐 Internet-Facing: LOW - This vulnerability requires local access to the system, not remote exploitation.

🏢 Internal Only: MEDIUM - Internal users with local access to QRadar systems could exploit this vulnerability to gain sensitive information.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW - Requires only local file read access to log files.

Exploitation requires local access to the QRadar system and ability to read log files.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apply IBM QRadar SIEM 7.5.0 Update Package 13 or later

Vendor Advisory: https://www.ibm.com/support/pages/node/7237317

Restart Required: Yes

Instructions:

1. Download Update Package 13 or later from IBM Fix Central. 2. Follow IBM's QRadar update procedures. 3. Apply the update package. 4. Restart QRadar services as required.

🔧 Temporary Workarounds

Restrict log file permissions

linux

Change permissions on QRadar log directories to restrict access to authorized users only.

chmod 750 /var/log/qradar.log
chown root:root /var/log/qradar.log

Implement file integrity monitoring

all

Monitor QRadar log files for unauthorized access attempts.

🧯 If You Can't Patch

Implement strict access controls to limit who can access QRadar systems locally.
Regularly audit and monitor access to QRadar log files for suspicious activity.

🔍 How to Verify

Check if Vulnerable:

Check QRadar version via Admin interface or run: /opt/qradar/bin/qradar_versions

Check Version:

/opt/qradar/bin/qradar_versions

Verify Fix Applied:

Verify version is 7.5.0 Update Package 13 or later using the same version check command.

📡 Detection & Monitoring

Log Indicators:

Unauthorized access attempts to QRadar log files
Suspicious file read operations on log directories

Network Indicators:

N/A - Local vulnerability only

SIEM Query:

source='QRadar' AND (event_name='File Access' OR event_name='Permission Change') AND file_path LIKE '%/var/log/qradar%'

📊 Metadata

CVE ID: CVE-2025-36050

CVSS v3 Score: 6.2 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-532

EPSS Score: 0.01% exploit probability (2th percentile)

Published: June 19, 2025

Last Updated: July 25, 2025

🔗 References

https://www.ibm.com/support/pages/node/7237317 Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-36050, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Qradar Security Information And Event Manager by Ibm

Qradar Security Information And Event Manager by Ibm

Qradar Security Information And Event Manager by Ibm

Qradar Security Information And Event Manager by Ibm

Qradar Security Information And Event Manager by Ibm

Qradar Security Information And Event Manager by Ibm

Qradar Security Information And Event Manager by Ibm

Qradar Security Information And Event Manager by Ibm

Qradar Security Information And Event Manager by Ibm

Qradar Security Information And Event Manager by Ibm

Qradar Security Information And Event Manager by Ibm

Qradar Security Information And Event Manager by Ibm

Qradar Security Information And Event Manager by Ibm

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Restrict log file permissions

Implement file integrity monitoring

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities